Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
96.9.79.178 has a threat confidence score of 99%. This IP address from Cambodia (AS131207, SINET, Cambodias specialist Internet and Telecom Service Provider.) has been observed in 90 honeypot sessions targeting REDIS protocols. Detected attack patterns include redis cron persistence via config and save sequence. First observed on March 25, 2026, most recently active March 31, 2026.
Identifies a full Redis exploitation sequence where the attacker performs configuration introspection, modifies persistence parameters (CONFIG SET dir, CONFIG SET dbfilename), optionally disables write protections (stop-writes-on-bgsave-error), flushes existing data, implants a cron-formatted payload (base64 or Python dropper variant), and triggers SAVE to write the malicious cron file to disk. This tightly coupled chain reflects automated exploitation of exposed Redis services to achieve host-level persistence via cron injection. The behavior indicates deliberate filesystem redirection and scheduled command execution establishment, commonly observed in botnet propagation and cryptomining campaigns targeting unauthenticated Redis instances.
Identifies execution of the Redis INFO command (case-insensitive), which retrieves server configuration, version, memory usage, and runtime statistics. This behavior reflects service interrogation and environment fingerprinting activity. While INFO can be used legitimately by administrators, it is also commonly observed during automated scanning and pre-exploitation reconnaissance of exposed Redis instances.